Privacy Policy

This is an unofficial English translation provided for your convenience. The original Japanese version (プライバシーポリシー) is the authoritative text, and in the event of any discrepancy, the Japanese version governs.

This Privacy Policy sets out how Ryo Watanabe (渡部 龍), trading as High Climb Studio (the "Operator") handles personal information in connection with the climbing social app "High Climb" (the "App"). The Operator considers protecting users' personal information important, and this Policy explains the information we collect, how we use it, and users' rights.

1. Information We Collect

1.1 Account Information

When you sign in with a Google account or an Apple account, we obtain the following information.

• Email address (if you use Apple's "Hide My Email" feature, the forwarding address issued by Apple)
• Display name
• Profile image (if provided)

1.2 Profile Information

We store the following information that users optionally register.

• Username
• Bio
• Avatar image
• Home gym
• When you started climbing
• Social media account information (Instagram, X (Twitter), and TikTok usernames)
• Timezone information (IANA format, e.g., Asia/Tokyo)
  • Obtained automatically from your device settings and used for period calculations such as daily aggregation and weekly rankings.
  • Because an IANA timezone can suggest an approximate geographic location, we treat it as quasi-personal information.
  • Not disclosed to other users.

1.3 Location Data

• The App uses location data to display nearby gyms and to confirm, when submitting a record (attempt) at a gym, that you are near that gym (within a 500-meter radius).
• Location data is only obtained while the App is in the foreground (in use); it is not obtained in the background.
• The location data (coordinates and accuracy) sent from your device when submitting a record is used only to confirm proximity to the gym and is not stored on the server.
• Using location data requires device permission, and you can revoke that permission from your device settings at any time.

1.4 Photos and Videos

• We store photos of walls, photos of problems, and climbing videos that users post.
• Photos of problems are analyzed on your device for hold detection (a machine learning model). This processing is completed on-device, and the image data is never sent to an external server.
• Regardless of the visibility setting (public, mutual-followers only, etc.), gym operators can view the content of videos posted for walls and problems within their own gym, from the gym operator management screen. This is limited to the extent necessary to check for and remove content that violates the Terms of Service or other inappropriate posts (see §3.1 for details).

1.5 Usage Data

We automatically record the following information as you use the App.

• Gym visit records (visit history derived from problem attempt records)
• Problem attempt records (send/no-send results)
• Rating data (number of matches, rate value) used to calculate estimated grades and display the rating ranking
• Usage of social features such as follows and favorites
• Entry information, check-in records, and results (rank and score) for events hosted by climbing gyms
• Per-hosting-gym check-in records for events held across multiple gyms (hosting gyms meaning the organizing gym and any gym that has accepted the organizing gym's invitation; the same applies below)
• Operational notes (staff notes) that climbing gym staff record for each event participant
• For events where the organizing gym has enabled member number recording, the member number issued by that gym, registered by that gym's staff at check-in (see §3.4 for details)
• Tutorial completion records (which tutorial items were completed, and when)

1.6 Error Information

To improve app stability, we collect crash reports and error information through Sentry (an error monitoring service). The information collected includes device information such as the app version, OS, and screen size; the operation history and destination address at the time of the error; and the user ID used to identify your account. We do not send your name, email address, or display name.

1.7 Push Notification Tokens

• We collect and store the push notification token of any device on which the user has allowed notifications, in order to deliver push notifications.
• Notifications are delivered using Expo Push Service (United States), and the push notification token and notification content are sent at the time of delivery (see §3).
• You can change whether you receive notifications at any time from your device settings and the in-app notification settings.

1.8 Android Beta Program Application Information

The Google Play closed test for the Android version has ended, and we are no longer accepting beta applications. Application information stored during the acceptance period has been deleted from the App's servers.

1.9 Problem Memos and External Service Post Links

• We store personal memos that users optionally record for each problem. Memos can only be viewed by the user themselves and are not disclosed to other users or gym operators.
• We store the URLs of posts on external services (Instagram, YouTube) that users link to problems. For Instagram posts, we store the post's thumbnail image on the App's server (Cloudflare). For YouTube videos, we do not store the thumbnail image on the App's server; instead, your device retrieves it directly from YouTube's (Google's) server each time it is displayed (this retrieval sends your device's connection information, such as its IP address, to Google). In addition, when a user saves a YouTube video URL and when we retry fetching the thumbnail, the App's server sends the video's ID to YouTube (Google) to confirm the video exists and can be displayed, and to obtain the thumbnail image's URL (we do not send the App's user ID or contact information). Linked posts are displayed to other users under the same visibility setting as climbing videos.

For details on information sent directly from your device to external providers, please see External Transmission Disclosure.

1.10 Event Guest Participant Information

• When a person without an App account participates in an event hosted by a climbing gym, the staff of the organizing gym (or, for events held across multiple gyms, a hosting gym) may, after obtaining the consent of that person (or, for a minor, their guardian), register the guest participant's name (a nickname may be used).
• For events where the organizing gym has enabled member number recording, the organizing gym's staff may, after obtaining the person's consent, also register the member number issued by the organizing gym. The member number is viewable only by the organizing gym's operator and is not shown to other users.
• A guest participant's name and event results (rank and score) are used only for the purposes of managing the event and displaying results, and are shown within the same scope as the event participant information described in §3.4.
• If a guest participant wishes to correct or delete their information, please contact the organizing gym, a hosting gym, or the contact point in §9.
• For events held across multiple gyms, a guest participant registered at any one hosting gym is shown at all of that event's hosting gyms.

2. Purposes of Use

We use the information we collect for the following purposes.

• Creating, authenticating, and managing accounts
• Providing the gym visit recording feature
• Providing the problem creation and sharing feature
• Providing social features (follows, activity feed, etc.)
• Managing users' climbing records
• Providing the feature to save and display personal memos and external service post links for problems
• Providing the Kids Account feature (allowing a guardian to manage a child's climbing records)
• Automatically calculating and visualizing skill level based on a user's results (send, no send, number of attempts) on climbing problems
• Displaying the in-gym rating ranking (for paid-plan users)
• Managing participants, check-in, and aggregating and displaying results (rank and score) for events hosted by climbing gyms (including display within the App and on the public web page provided by the Operator; for events held across multiple gyms, this includes managing check-in at each hosting gym, and displaying combined and per-gym results, including the names of the hosting gyms where each participant recorded climbs)
• Recording operational notes (staff notes) that climbing gym staff make for each event participant
• Matching an event participant against the organizing gym's membership records, and assisting input of member numbers at check-in for other events that gym organizes (both limited to events where member number recording is enabled)
• Producing anonymized aggregate statistics for gym operators (visit trends, hourly congestion, average dwell time, etc.; no individually identifiable metrics are included)
• Content management by gym operators (checking for and removing violations of the Terms of Service and other inappropriate posts within their own gym)
• Delivering push notifications
• Detecting and fixing App defects
• Improving UI/UX based on analysis of App usage (screen-level usage rate, feature usage frequency, churn rate, etc.)
• Planning new features and new plans
• Running campaigns and giveaways (selecting eligible participants, drawing winners, contacting winners and sending prizes, and announcing winners). Regardless of a user's display name visibility setting, we may show a winner's display name (not their username) in the winner announcement notice. Kids Accounts are not eligible.

3. Provision to Third Parties

The App does not sell or lend users' personal information to third parties, or share it for advertising purposes.

However, we may share information with our subcontractors to the extent necessary to provide the following services.

Push notifications reach your device via Google (Firebase Cloud Messaging) or Apple (Apple Push Notification service) delivery infrastructure, through Expo.

The following providers are not subcontractors of the App and handle information under their own terms and privacy policies. In connection with your use of the App, information is sent to these providers within the following scope.

Transmissions from the App's server do not include your user ID or contact information. For information sent directly from your device, please also see External Transmission Disclosure.

We may also disclose user information where required by a legal disclosure request.

3.1 Joint Use with Gym Operators

Under Article 27, Paragraph 5, Item 3 of Japan's Act on the Protection of Personal Information (個人情報の保護に関する法律), the App jointly uses personal data with climbing gym operators within the following scope.

• Items of personal data jointly used: display name, username, avatar image, visit records within the gym (derived from problem attempt records), attempt records for walls and problems within the gym, videos posted for walls and problems within the gym (viewable for moderation purposes regardless of the visibility setting), creator information for walls and problems within the gym, entry information, check-in records, and results (including rank and score) for events that gym organizes, the names and event results of guest participants for events that gym organizes (registered by staff with the participant's consent), the gym's usage statistics (aggregated visit counts, hourly congestion, average dwell time, etc.; no individually identifiable metrics are included), member numbers issued by the gym for participants (including guest participants) of events that gym organizes, registered by that gym's staff at check-in for events where member number recording is enabled, operational notes (staff notes) the gym records for each participant, and — for events held across multiple gyms where the gym is a hosting gym — the list of participants (including guest participants), check-in status at all hosting gyms, combined and per-gym rankings and scores, results per problem at each hosting gym, and visit days at hosting gyms
• Scope of joint users: the operator of a climbing gym at which the user has submitted a record (attempt) or registered it as their home gym, or entered or checked in to an event that gym organizes (limited to holders of a High Climb "Gym Operator Portal" account, or those registered within the App as an operator or staff member of that gym), and, when a user or guest participant enters an event held across multiple gyms, the operators of gyms that were hosting gyms of that event at the time of entry
• Purposes of use by joint users: operating their own gym, checking for and removing content that violates the Terms of Service, analyzing their own gym's usage statistics, matching event participants against their own gym's membership records, assisting input of member numbers at check-in for other events they organize, and operating events held across multiple gyms where their gym is a hosting gym
• Party responsible for managing the personal data: Ryo Watanabe (渡部 龍), trading as High Climb Studio / Nishi-Shinjuku Mizuma Building 2F, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan (〒160-0023 東京都新宿区西新宿3丁目3番13号 西新宿水間ビル2F) / contact: [email protected]

Regardless of the visibility setting a user has chosen (public, mutual-followers only, etc.), gym operators can view the content of videos. This is limited to the extent necessary to identify and remove content that violates the Terms of Service or other inappropriate posts.

Under the Gym Operator Portal Terms of Service (Japanese) entered into with High Climb, gym operators are prohibited from using information they learn in the course of their duties for any purpose other than the joint-use purposes described above. They cannot view information about other gyms or users unrelated to their own gym. However, for events held across multiple gyms, the operator of a gym approved as a hosting gym for that event may view, including for the other hosting gyms, the list of participants (including guest participants) at that event, check-in status at all hosting gyms, combined and per-gym rankings and scores, results per problem at each hosting gym, and visit days at hosting gyms (including operators of hosting gyms you have not yet checked in at). Except for staff notes their own gym has recorded, they cannot view staff notes recorded by other hosting gyms.

If a gym operator removes content, the reason for removal is recorded by both the gym operator and the High Climb Operator.

3.2 Provision to Third Parties in Foreign Countries

The App transfers data to providers based in the United States for usage analysis (PostHog), push notification and app update delivery (Expo), error monitoring (Sentry), sending emails (Resend), data storage and content delivery (Cloudflare), subscription management (RevenueCat), notifications to administrators of reports (Slack), and the recipients in §3 that are not our subcontractors (Google, Apple, Meta). We also transfer data, for authentication (Supabase), to a provider based in Singapore (Supabase Pte. Ltd.) (the data is then stored via that company on servers in Japan (Tokyo)).

• Recipient countries: United States, Singapore
• Overview of the recipient countries' personal information protection regimes: The United States does not have a comprehensive federal personal information protection law; it is regulated by state laws (such as the California CCPA/CPRA) and sector-specific laws. Singapore has a comprehensive personal information protection law, the Personal Data Protection Act 2012. For details, please see materials published by Japan's Personal Information Protection Commission.
• Measures taken by the recipients: PostHog Inc. holds SOC 2 Type II certification and implements TLS communication and encryption at rest. Expo (650 Industries, Inc.) protects data through TLS communication and handles data only to the extent necessary to deliver push notifications. Sentry (Functional Software, Inc.) holds SOC 2 Type II and ISO 27001 certification and implements TLS communication and AES-256 encryption at rest. Resend (operated by Plus Five Five, Inc.) holds SOC 2 Type II certification (it does not hold ISO 27001 certification) and implements AES-256 encryption at rest and TLS encryption in transit. Supabase (Supabase Pte. Ltd.) and RevenueCat, Inc. each state in their published data processing agreements that they provide safeguards for transfers using the EU Standard Contractual Clauses. Cloudflare, Inc. holds an EU-US Data Privacy Framework certification. Its data processing agreement states that it is incorporated into its terms of service for personal data of individuals in Europe and California, and it is not clear from that agreement whether it applies to the data of users in other regions. Salesforce, Inc., which provides Slack, states in its published data processing agreement that it provides safeguards for transfers using binding corporate rules and the EU Standard Contractual Clauses, but the App has not entered into this agreement with that company. Google LLC, Apple Inc., and Meta Platforms, Inc. are not subcontractors of the App, and because the App has not defined their handling of data by contract, we do not know the details of the measures each company takes. Each company handles information in accordance with its own published privacy policy.
• Obtaining consent: We obtain your consent when you first start using the App, by your agreement to this Privacy Policy. You can stop the sending of usage analysis data at any time from the "Account Settings" screen within the App. You can disable push notifications at any time from your device settings and the in-app notification settings. You can stop the App from sending error information at any time from the "Account Settings" screen within the App (this setting does not affect error information that originates on the App's server, which is sent regardless). Among the emails we send, we do not offer an individual opt-out for authentication emails. If you wish to stop receiving campaign/giveaway winner notifications, please contact us through "9. Contact, Business Operator Disclosure, and Disclosure Request Procedures."

3.3 Display on the Rating Ranking

The App may display a user's rating (number of matches and rate value) and rank in a ranking format (the in-gym ranking) to other users of the same climbing gym. This display is shown to users who use the rating feature on a paid plan (Light or above).

• The ranking covers users at that gym who have a certain amount of challenge history and a confirmed rating. For users whose display name visibility is set to limited or private, we show the rank and rate under an anonymous label with the display name hidden.
• Users can stop being listed on the in-gym ranking (opt out) from within the App's settings. If you opt out, you will not be shown on the ranking at all, regardless of your display name visibility setting. This setting is available to all users, including those who have not subscribed to a paid plan.
• To prevent individuals from being identified, we do not display the in-gym ranking for gyms where fewer than a set number of eligible users (5) are listed.
• The value shown on the ranking is a display rating value adjusted based on grade and may differ from the internal calculated value.

3.4 Display of Event Participant Information

When a user enters an event hosted by a climbing gym, the operator of the organizing gym may, through the Gym Operator Portal or the App's gym-staff features, view the participant's display name, check-in status, and event results (including rank and score), and identify individual participants. When an event is held across multiple gyms, the operators of that event's hosting gyms may likewise view and identify the list of participants (including guest participants) at the event, check-in status at all hosting gyms, combined and per-gym rankings and scores, results per problem at each hosting gym, and visit days at hosting gyms (including operators of hosting gyms you have not yet checked in at). In addition, before an event starts or while its results are unpublished, other users of the App may view a participant's display name (subject to the display name's visibility setting) and check-in status. Once results are published, users may also view rank and score. In addition, published results (including participants' display names or names, ranks, and scores) are published on a public web page provided by the Operator, viewable by anyone who knows the page's URL, including people who do not have an account for the App. For users who have an account for the App, the display name shown on the public web page also follows the display name's visibility setting; if it is set to anything other than "Everyone," the display name is hidden. Event results may continue to be displayed as a record even after the event has ended. We ask for your consent to this handling when you enter an event. If you would like this display stopped, please contact us through "9. Contact, Business Operator Disclosure, and Disclosure Request Procedures."

In addition, if the organizing gym has enabled member number recording, that gym's staff may, at check-in, register the member number a participant has been issued by that gym, for the purposes of matching against that gym's membership records and managing the event. The registered member number is viewable only by that gym's operator and is not shown to other users. Member numbers are recorded per event entry. For a subsequent event that same gym organizes, to assist check-in, the member number previously registered with that gym may be pre-filled in the staff's input field. This display is shown only to that gym's staff and is not shown to other users.

For events held across multiple gyms, if your display name visibility is set to "Gym members only," it is shown to users of any of that event's hosting gyms (regardless of whether the participant themselves uses that gym). For such events as well, combined and per-gym results (including rank, score, and the name of the hosting gym where each participant recorded climbs) are likewise published on the public web page described above. Participants' member numbers are not used for such events. After you cancel your entry, hosting gym operators can no longer newly view your information.

4. Data Storage

• User data is stored on Cloudflare's servers.
• Authentication information is stored on Supabase's servers.
• Usage analysis data is sent to and stored on PostHog's (United States) servers.
• Error information is sent to and stored on Sentry's (United States) servers.
• Emails are sent through Resend (United States).
• All communication is encrypted using HTTPS.
• See §4.1 for the retention period of each type of data.

4.1 Data Retention Periods

• Gym visit records: retained while your account is active. On account deletion, the underlying problem attempt records are anonymized (see §5).
• Climbing videos: retained for a period of 180 days (Free / Light) to 730 days (Pro / 2 years), depending on your plan. Specific expiry dates are shown in the video list within the App. For details on the limits for each plan, see Article 9 of the Terms of Service. All videos are deleted on account deletion, regardless of your plan.
• Usage analysis data (PostHog): follows PostHog's data retention policy.
• Error information (Sentry): follows Sentry's data retention policy.
• Email content and delivery logs (Resend): follows Resend's retention period.
• The list of eligible participants, winners, and working files for sending prizes for a campaign or giveaway: deleted promptly after the redemption deadline for the prize has passed, or, if there is no such deadline, after the prize has been sent.

5. Data Deletion

For detailed procedures and how your data is handled, please see the Delete Account page (Japanese).

Users can delete their account at any time from the settings screen within the App. However, you cannot delete your account while registered as staff or an owner of an official gym. Have the gym's owner remove your staff registration, transfer your owner registration to another staff member through the Gym Operator Portal, and have the new owner remove you as staff, before deleting your account (see the Delete Account page (Japanese) for details).

Deleting your account results in the following processing.

• Deletion of your account information and profile information
• Deletion of follows, favorites, your own rating history, and push notification tokens
• Records of rating changes for problems retain your own user ID (used only for the Operator's aggregate processing and not shown to other users)
• Deletion of posted video files
• Deletion of personal problem memos and links to posts on external services (Instagram, YouTube), including their thumbnail images
• Problem attempt records are retained as anonymized data, with the link to you removed (used to maintain the accuracy of problem difficulty statistics)
• Anonymization of creator information for gyms, walls, and problems you created (the content itself remains, to keep the service running; problem photos are also not deleted and remain published)
• Reports and feedback to the Operator, and notices, event result records, etc., you created as gym staff, are retained with the creator/recorder information anonymized
• Entry information and results (rank and score) for events you participated in may be retained as a record kept by the gym(s) that hosted the event (each hosting gym, for events held across multiple gyms), with information identifying you, such as your display name, anonymized
• Deletion of member numbers recorded for event entries
• Deletion of operational notes (staff notes) gym operators recorded for you as a participant

Deleted data remains in the App's database restore records (backups) for up to 30 days before being automatically erased. If we restore the database from one of these records, data belonging to accounts deleted during that window may be restored.

If part of the deletion process fails, some data may remain. Files such as videos, thumbnails, and avatar images may remain on the server and continue to be viewable at their address (URL). Authentication information (such as your email address) on the authentication service (Supabase) may also remain. If you notice this, please contact us through "9. Contact, Business Operator Disclosure, and Disclosure Request Procedures."

Note that working files for campaigns/giveaways, display names shown in winner announcement notices, and Resend's delivery logs are not automatically deleted when you delete your account. Records of administrative actions taken by the Operator (such as suspensions or plan changes, which include the relevant user's user ID) are retained after account deletion. If you wish to have these deleted, please contact us through "9. Contact, Business Operator Disclosure, and Disclosure Request Procedures."

6. Children's Privacy

Children under 13 cannot register their own account to use the App.

However, a Guardian (a parent or other legal guardian) may create a Kids Account linked to their own account (Terms of Service Article 4-2) and manage their child's climbing records under that Guardian's control. For a Kids Account, the App handles a child's information as follows.

• Information we collect: the child's name registered by the Guardian (a nickname may be used) and username, and climbing records on the Kids Account (problem attempt records, gym visit records, videos and photos, rating data, etc.). We do not collect the child's date of birth or age. If the child participates in an event where the organizing gym has enabled member number recording, we may collect the member number issued by that gym.
• Who provides consent: the Guardian, as the child's legal representative, creates the Kids Account and agrees to the handling described in this Policy. If a Guardian enters their child in an event held across multiple gyms, we will separately obtain the Guardian's consent again.
• Visibility: the Guardian sets the visibility of the Kids Account's profile and records. By default, the display name and climbing videos are both private, and the account is not listed on the in-gym ranking. If the Guardian changes the visibility settings, the display name and climbing videos will be shown to users within the selected scope, and if the in-gym ranking listing is enabled, the account will appear on that ranking. When event results are published on the public web page, if the display name's visibility is set to "Everyone," the display name will also appear on that page (§3.4). Note that a Kids Account's profile screen is not shown to anyone other than the Guardian, and no follow relationships with other users are created for it. It is also subject to joint use with the operator of the gym where records were made (§3.1). If the Kids Account enters an event held across multiple gyms, it is also subject to joint use with that event's hosting gyms, and, regardless of the visibility setting, the child's name is shown to the staff of the hosting gyms of an event the child has entered.
• Guardian management: the Guardian can view or delete the Kids Account's records, and delete the Kids Account itself, at any time from within the App. Requests for disclosure and similar matters regarding the child's information (§9.2) should be made by the Guardian.
• When the Guardian deletes their account: if a Guardian deletes their account, any Kids Accounts that have not been transferred will also be deleted. The handling of data in that case (the split between deletion and anonymized retention) is the same as for ordinary account deletion (§5).
• Transfer to a regular account: when a child turns 13 and transfers to a regular account, we will ask the child directly to agree to this Policy at the time of transfer. After transfer, the records on the Kids Account carry over as records under the child's own account. At the time of transfer, the visibility of the display name, climbing videos, and activity is set to mutual-followers only, and the in-gym ranking listing is set to unlisted; after that, the child can change these visibility settings themselves like any regular account. Note that after transfer, other users will be able to find the account by searching for its display name or username, and regardless of the visibility setting, the display name, username, and avatar image will be shown to other users in places such as user search results and follow/follower lists, and any registered bio, when the child started climbing, and social media account information (including information the Guardian registered during the Kids Account period) will be shown on the profile screen.

7. User Rights

Users have the following rights.

• You can change or delete your profile information at any time from the settings screen within the App.
• You can revoke permissions such as camera and location access at any time from your device settings.
• You can request the erasure of stored data by deleting your account.
• You can turn the sending of usage analysis data (PostHog) on or off at any time from the "Account Settings" screen within the App.
• You can turn the App's sending of error information (Sentry) on or off at any time from the "Account Settings" screen within the App.
• The usage analysis and error information sending settings above apply to the device on which you configured them.

7.1 Requests for Disclosure of Data

Users may request disclosure of their own personal data held by the App. Please contact us at the address below to make a disclosure request. After verifying your identity, we will respond within a reasonable time. The App has no feature to bulk export your held personal data, so the Operator will respond to disclosure requests individually.

8. Changes to This Policy

This Privacy Policy may be changed as necessary. If we make an important change, such as adding a purpose of use or expanding the scope of third-party provision, we will display the revised content on the consent screen shown when the App starts and ask users to agree again. We operate on the basis that you will use the service after providing your consent.

The revised Privacy Policy takes effect for a user once that user provides consent on that consent screen.

9. Contact, Business Operator Disclosure, and Disclosure Request Procedures

9.1 Business Operator Handling Personal Information

• Name of the business operator: Ryo Watanabe (渡部 龍), trading as High Climb Studio
• Address: Nishi-Shinjuku Mizuma Building 2F, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan (〒160-0023 東京都新宿区西新宿3丁目3番13号 西新宿水間ビル2F)
• Personal Information Protection Manager: Ryo Watanabe (渡部 龍) (contact regarding the handling of personal information: [email protected]. If a dedicated contact point is established in the future, it will be announced in this Policy)

9.2 Procedures for Disclosure and Similar Requests

You may request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision of personal data the App holds about you. The procedure is as follows.

1. Contact [email protected] with the subject "Personal Information Disclosure Request"
2. For identity verification, send the request from the email address registered with the App, and include your in-app user ID
3. The Operator will respond within a reasonable time of receipt (as a general guideline, within 2 weeks). Disclosure will be handled by the Operator checking the data individually
4. No fee is charged (however, if postal or similar costs are incurred, we may ask you to cover the actual cost)

9.3 Contact and Complaints

If you have questions about this Policy or complaints regarding the handling of personal information, please contact us at the address below. This contact point also accepts inquiries from data-protection authorities of various countries, in addition to individuals. Note that the App is not a member of any certified personal information protection organization.

[email protected]

10. Supplementary Provisions for Users in Taiwan and Citizens of the Republic of China (Taiwan)

This Section applies to users in Taiwan, and to citizens of the Republic of China (Taiwan) to whom Taiwan's Personal Data Protection Act applies under Article 51, Paragraph 2 of that Act. Where this Section differs from other Sections, this Section takes precedence for these users.

10.1 Notification Items

• Name of the business operator: as set out in 9.1.
• Purposes of collection and categories of personal data: as set out in 1 and 2.
• Sources: from you directly, and also from Google or Apple (used for sign-in), gym staff (guest participants' names, member numbers, and operational notes), and your guardian (Kids Account information).
• Period of use: as set out in 4.1 and 5.
• Regions of use: Japan, where the Operator is located, and the countries of the recipients listed in 3.2 (the United States and Singapore). Each provider may process information on servers located outside these countries.
• Parties who may use the data: the Operator; the subcontractors and recipients listed in 3; the gym operators listed in 3.1; and, within the scope described in this Policy, other users and visitors to the public web page.
• Method of use: recorded and processed electronically. Automated processing is used to calculate estimated grades, ratings, and rankings.
• Your rights and how to exercise them: as set out in 10.3.
• Effect of not providing your data: as set out in 10.4.

10.2 Basis for Collection and Processing

• Contract (Article 19, Paragraph 1, Item 2 of Taiwan's Personal Data Protection Act): creating and managing your account, providing features such as climbing records, problems, and videos, joint use with gym operators, operating events, push notifications, subscription management, responding to reports, and error monitoring
• Consent (Item 5 of the same paragraph): usage analysis, and running campaigns and giveaways

If your device's region setting is Taiwan, usage analysis is not performed by default, and only occurs if you turn on sending from the "Account Settings" screen within the App. We also do not attach a user ID to error information sent from the App.

10.3 Your Rights and How to Exercise Them

You may request to inquire about and view, obtain a copy of, supplement or correct, stop the collection, processing, or use of, or delete your own personal data. Please make such a request using the procedure in 9.2. If you do not have an account for the App, please contact us at the point in 9.3, and we will guide you through the identity-verification process. The Operator will decide whether to grant a request to inquire about and view, or to obtain a copy of, your data within 15 days of receipt, and a request to supplement or correct, stop, or delete your data within 30 days of receipt. If we are unavoidably unable to meet this period, we will notify you in writing (including by email) of the extension period (up to 15 additional days for inquiry, viewing, and copy requests, and up to 30 additional days for other requests) and the reason.

10.4 Effect of Not Providing Personal Data

If you do not provide the information necessary to register for an account (1.1), you cannot use the App. Other information (profile information, location data, photos and videos, etc.) is provided voluntarily; you can still use the App without providing it, but features that rely on that information may be unavailable.

10.5 Notification in the Event of a Data Breach

If the Operator becomes aware of a breach or similar incident involving personal data it holds, the Operator will notify you in accordance with Taiwanese law.

10.6 Application of Law

This Policy does not affect the application of Taiwan's Personal Data Protection Act or other applicable laws, or your right to file a complaint with the relevant authority under those laws.

Revision History

• May 5, 2026: Initial version
• June 14, 2026 revision (effective June 19, 2026): Added a note on displaying the rating ranking (§3.3) and displaying event participant information to gym operators (§3.4), and added event-related data to the items of joint use (§3.1)
• June 26, 2026 revision (effective July 10, 2026): Expanded the scope of viewing event results and participant information to all authenticated users within the app, and added the right to request that display be stopped (§3.4)
• July 10, 2026 revision (effective July 24, 2026): Newly established the handling of a child's information for Kids Accounts (§6), added the collection of problem memos and Instagram post links (§1.9, §2), specified sign-in with an Apple account (§1.1, §3), added push notification tokens and the delivery platform (Expo) and event guest participant information (§1.7, §1.10, §3, §3.1, §3.2), updated the description of location data (§1.3, §4.1), and removed the description of the discontinued grade-feel feedback feature
• July 24, 2026 revision (effective July 24, 2026): Added provisions on recording event participants' member numbers (§1.5, §1.10, §2, §3.1, §3.4, §5)
• August 23, 2026 revision (effective August 23, 2026): Updated the description of information collected for error monitoring (Sentry) to specify that a user ID is included (§1.6, §3), and added Sentry to the list of third parties in foreign countries and to data storage locations (§3.2, §4)
• August 27, 2026 revision (effective August 27, 2026): Added a note that you cannot delete your account while you remain registered as staff or an owner of an official gym (§5)
• August 28, 2026 revision (effective August 28, 2026): Added, as a purpose for using an event participant's member number, assisting input at check-in for other events that same gym organizes, and expanded the description of the scope of joint users and the viewing/registration of event participant information (§2, §3.1, §3.4, §6)
• September 1, 2026 revision (effective September 1, 2026): Specified that event results are published on the public web page provided by the Operator, viewable by anyone including people without an account for the app (§2, §3.4; §1.10 guest participants are shown within the same scope). Revised the description of Kids Accounts' visibility settings to match the settings guardians can configure, and specified the conditions for display on the public web page (§6)
• September 14, 2026 revision (effective September 14, 2026): Added YouTube to the external services whose post links can be linked to problems, and revised the description of the information we collect and how we handle it on deletion to "links to posts on external services (Instagram, YouTube)." Specified that YouTube thumbnail images are not stored on the App's server and are retrieved directly from YouTube by your device (§1.9, §5). Specified the information shown to other users regardless of the visibility setting when a Kids Account transfers to a regular account (display name, username, avatar image, bio, when you started climbing, social media account information, etc.) and where it is shown (user search results, follow lists, profile screen, etc.) (§6). Specified the collection of tutorial completion records (§1.5); added running campaigns and giveaways (selecting eligible participants, drawing winners, contacting winners and sending prizes, and announcing winners) as a purpose of use, and specified that Kids Accounts are not eligible (§2); added Resend (sending emails) to our subcontractors and to third parties in foreign countries (§3, §3.2); specified the retention period for campaign/giveaway data and data not automatically deleted on account deletion (§4.1, §5); specified that when a user saves a YouTube video URL and when we retry fetching the thumbnail, the App's server sends the video's ID to YouTube (Google), and added a link to the "External Transmission Disclosure" page summarizing information sent from your device to external providers (§1.9)
• September 19, 2026 revision (effective September 19, 2026): Newly added a description of events held across multiple gyms, added the collection of per-hosting-gym check-in records, and specified that operational notes (staff notes) already recorded for existing events are part of the information we collect (§1.5, §3.1); added that a guest participant is shown at all hosting gyms and that a correction can be requested at any hosting gym (§1.10); added check-in management as a purpose of use, specified recording staff notes as a purpose of use, and added the display of combined and per-gym results (including the names of the hosting gyms where each participant recorded climbs) on the public web page (§2); expanded the scope and items of joint use with gym operators to include, for a hosting gym, a list of participants (including guest participants) at hosting gyms, check-in status, combined and per-gym rankings and scores, results per problem at each hosting gym, and visit days, and added an exception allowing an approved hosting gym to view that event's participant information (§3.1); added that operators of hosting gyms may also view and identify the list of participants, check-in status, and results — including operators of hosting gyms you have not yet checked in at — that a display name set to "gym members only" is shown to members of any of the event's hosting gyms regardless of whether you use that gym yourself, that combined and per-gym results for such events (including rankings, scores, and the names of the hosting gyms where each participant recorded climbs) are also published on the public web page, that member numbers are not used, and that after you cancel your entry, hosting gym operators can no longer newly view your information (§3.4); changed the description of where anonymized event records are retained after account deletion to "the gyms that hosted the event (each hosting gym, for events held across multiple gyms)," and added staff notes recorded by gym operators to the data deleted on account deletion (§5); added that entering a multi-gym event with a Kids Account also brings that event's hosting gyms into the joint use described in §3.1, and that, regardless of your visibility setting, staff at the hosting gyms of an event your child entered can see your child's name, and that we will separately obtain a guardian's consent again if they enter their child in an event held across multiple gyms (§6)
• September 22, 2026 revision (effective September 22, 2026): Separated our subcontractors from recipients that are not our subcontractors (Google, Apple, Meta), and added the information sent — and where it is sent from — for sign-in, map display, address search, confirming and displaying thumbnails for linked YouTube videos, retrieving thumbnails for linked Instagram posts, and delivering app updates. Added these recipients to third parties in foreign countries, added that you can stop the App from sending error information, and added that the usage analysis and error information sending settings apply per device (§3, §3.2, §7). Added that photos of problems remain published after account deletion, that reports, feedback, and similar content are retained in anonymized form, that records of rating changes for problems keep your user ID, how we handle cases where part of the deletion process fails, that deleted data remains in backups for up to 30 days, and that we retain records of administrative actions taken by the Operator (§5). Updated the purpose and information shared for Slack notifications (§3). Reorganized the related descriptions following the end of the Android beta program (closed test) (§1.8, §2, §3, §4.1). Added that the Operator responds to disclosure requests individually (§7.1, §9.2). Added Cloudflare, RevenueCat, Slack, and Supabase (Singapore) to the third parties in foreign countries, and added that we also accept contact from data-protection authorities at our contact point (§3.2, §9.3). Newly established supplementary provisions for users in Taiwan and citizens of the Republic of China (Taiwan), covering notification items and sources, the basis for collection and processing, your rights and how to exercise them, the effect of not providing your data, notification in the event of a breach, and the application of law (§10)